Security ToolsFree

HMAC Generator

Generate HMAC (Hash-based Message Authentication Code) signatures using SHA-256. Enter your message and secret key to produce a tamper-proof signature that verifies both message integrity and authenticity. Uses the Web Crypto API — entirely in-browser.

Frequently Asked Questions

What is HMAC used for?▼
HMAC verifies that a message was not tampered with in transit and was sent by someone who knows the secret key. It is widely used for API authentication, webhook signature verification, and data integrity checks.
Which HMAC algorithm is used?▼
HMAC-SHA256, using the browser's Web Crypto API. This is the most widely used HMAC variant and the standard for API authentication (e.g., AWS signatures, Stripe webhooks).
What is the difference between HMAC and a plain SHA-256 hash?▼
A plain SHA-256 hash has no secret key — anyone can verify or create it. HMAC-SHA256 requires knowing the secret key to produce or verify the signature, making it suitable for authentication.
Is the HMAC computed in the browser?▼
Yes. The Web Crypto API handles all HMAC computation locally. Your message and secret key are never sent to any server.
How do I verify an HMAC signature?▼
Compute the HMAC of the received message with the same secret key. If the computed HMAC matches the received HMAC exactly, the message is authentic and unmodified.